full-disclosure - MyDoom download info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <000401c3e78d$cd03d010$0201a8c0@fosi>
From: steve.wray at paradise.net.nz (Steve Wray)
Subject: MyDoom download info

> From: full-disclosure-admin@...ts.netsys.com 
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of 
> first last
[snip]
> >
> >IIRC there are viruses that are encrypted and are almost impossible
> >to disassemble?
> >
> >Would that be true?
> >
> 
> Sobig.F was packed with tElock. It's a PE file protector. It 
> "encrypts" the program's code and data, and tries to detect debuggers
before 
[snip]
> to successfully unpack the program. All they really needed to 
> do was dump it from memory while it was running and they could've
analyzed 
> it immediately with any disassembler.

Forgive me, I am no assembly hacker nor much of a programmer, 
but would it be possible for a program to 'react' in some way
were one to try to dump it from memory?